Provider recipes#
One page per provider, each with the same shape: what to get from the provider, which driver to choose, what to type in the form, and how to tell that it worked.
Do How to install the backend and How to install the frontend first.
Pick a recipe#
Provider |
Driver |
Recipe |
|---|---|---|
Another Plone site |
|
|
Any OpenID Connect provider |
|
|
Emailed magic link |
|
|
Keycloak |
|
|
GitHub |
|
|
|
||
Microsoft Entra ID |
|
For anything not listed, use Any OpenID Connect provider: any provider that publishes a discovery document works with it, and the recipe says what to check first.
The redirect URI, once#
Every provider asks for a redirect URI, and it is the same value for all of them:
https://www.example.com/login-identity
That is your frontend base URL plus the callback path from the Identity
providers control panel. /login-identity is the default, and the route the
Volto add-on registers.
Two mistakes account for most redirect_uri_mismatch failures:
Using the backend's URL. The redirect goes to the frontend.
A trailing slash, or
httpwhere the provider hashttps. Providers match this string exactly.
Verification status#
Provider user interfaces change, and a recipe that claims to be current when it is not is worse than one that says it is unverified.
Recipe |
Provider-side steps |
|---|---|
verified against the demo stack, 2026-09-05 |
|
verified against the demo stack, 2026-09-05 |
|
verified against the demo stack, 2026-09-05 |
|
verified against Keycloak 26.0, 2026-09-05 |
|
not verified |
|
not verified |
|
not verified |
An unverified recipe keeps its provider-side steps short and links to the provider's own documentation, which is the part that stays current. The Plone side of every recipe is read from this package's source and is accurate.